EP1842333B1 - Verfahren, computerprogramm und vorrichtung zum schutz eines kernnetzes - Google Patents

Verfahren, computerprogramm und vorrichtung zum schutz eines kernnetzes Download PDF

Info

Publication number
EP1842333B1
EP1842333B1 EP05702266A EP05702266A EP1842333B1 EP 1842333 B1 EP1842333 B1 EP 1842333B1 EP 05702266 A EP05702266 A EP 05702266A EP 05702266 A EP05702266 A EP 05702266A EP 1842333 B1 EP1842333 B1 EP 1842333B1
Authority
EP
European Patent Office
Prior art keywords
message
mobile
received
network controller
identity
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Not-in-force
Application number
EP05702266A
Other languages
English (en)
French (fr)
Other versions
EP1842333A1 (de
Inventor
Jari Tapio Vikberg
Thomas Nylander
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Telefonaktiebolaget LM Ericsson AB
Original Assignee
Telefonaktiebolaget LM Ericsson AB
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Telefonaktiebolaget LM Ericsson AB filed Critical Telefonaktiebolaget LM Ericsson AB
Publication of EP1842333A1 publication Critical patent/EP1842333A1/de
Application granted granted Critical
Publication of EP1842333B1 publication Critical patent/EP1842333B1/de
Not-in-force legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0245—Filtering by information in the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/72—Subscriber identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/75—Temporary identity

Definitions

  • the present invention relates in general to the field of mobile communications and, more particularly, to a method and apparatus for protecting a core network by checking mobile identities of mobile stations within unlicensed mobile access networks.
  • the unlicensed mobile access (UMA) specifications recommend that the unlicensed network controller (UNC) and the unlicensed network controller secure gateway (UNC-SGW) should check that the same International Mobile Subscriber Identity (IMSI) is used when a mobile station (MS) establishes the IPsec secure connection towards the UNC-SGW and when the MS registers at the UNC. In both these instances, the MS provides the IMSI to the UNC-SGW and UNC, respectively. Yet, the implementation of these recommendations still leaves the core network open to attacks.
  • UMA unlicensed mobile access
  • a MS could use multiple Temporary Mobile Subscriber Identities (TMSI) or Packet Temporary Mobile Subscriber Identities (P-TMSI) to emulate multiple MSs, such as a personal computer (PC) with a SIM-card leader and a UMA client.
  • TMSI Temporary Mobile Subscriber Identities
  • P-TMSI Packet Temporary Mobile Subscriber Identities
  • a hostile MS could send Location Updates or IMSI Detach messages towards the core network causing a type of denial-of-service (DoS) attack on the MS-level (terminating calls would fail, etc.).
  • DoS denial-of-service
  • GTP GPRS Tunneling Protocol
  • SGSN Serving GPRS Support Node
  • GGSN Gateway GPRS Support Node
  • the GTP filter inspects, analyzes and filters the GTP packets/messages and drops any packets that do not satisfy various criteria. Although, the GTP filter does check the IMSI address, all of the filtering is performed at the GPRS service nodes, which is inside or at the perimeter of the core network.
  • the IEEE article entitled " User plane Firewall for 3G Mobile Network” by Gopal, Chan and Wang appears to disclose a firewall at the GGSN, which is stated to be the ideal place, to prevent attacks in a wireless network.
  • the firewall uses filters and policies/rules to identify malicious messages and discard them. All of the filtering is performed at the GGSN, which is at the perimeter of the core network.
  • United States Published Patent Application US2002/0032029 A1 discloses a system for transferring packet data within a multi-country telecommunications network.
  • the system includes devices and methods for detecting data packets corresponding to a particular mobile station routed through a telecommunications network of a first country, and detecting data packets corresponding to the particular mobile station transferred between the telecommunications network of the first country and at least a telecommunications network of a second country.
  • the present invention provides a method and apparatus that protects the core network by checking the mobile identities (International Mobile Subscriber Identity (IMSI), Temporary Mobile Subscriber Identity (TMSI) and/or Packet Temporary Mobile Subscriber Identity (P-TMSI)) used by mobile stations (MS) when they communicate with the core network.
  • IMSI International Mobile Subscriber Identity
  • TMSI Temporary Mobile Subscriber Identity
  • P-TMSI Packet Temporary Mobile Subscriber Identity
  • the present invention provides a method for protecting a core network by receiving a message containing a mobile identity of a MS and dropping the message whenever the received mobile identity does not match a stored mobile identity associated with the MS.
  • the message is processed whenever the received mobile identity matches the stored mobile identity associated with the MS.
  • the mobile identity can be an IMSI, TMSI or a P-TMSI.
  • the message can be an uplink message or a downlink message, such as a Mobility Management (MM) message, a General Packet Radio Service (GPRS) Mobility Management (GMM) message, or a UMA or Unlicensed Radio Resources (URR) message (only used between MS and UNC).
  • MM Mobility Management
  • GPRS General Packet Radio Service
  • GMM General Packet Radio Service
  • GMM General Packet Radio Service
  • UMR Unlicensed Radio Resources
  • the present invention can be implemented as a computer program embodied on a computer readable medium wherein the various method steps are implemented by one or more code segments.
  • the present invention provides an apparatus that includes a data storage device communicably coupled to a processor.
  • the data storage device stores associations of mobile identities to MSs.
  • the processor receives a message containing a mobile identity of a MS and drops the message whenever the received mobile identity does not match a stored mobile identity associated with the MS.
  • the apparatus is typically an unlicensed network controller (UNC) within an unlicensed mobile access network (UMAN) or a generic access network controller (GANC) within a generic access network (GAN) that is in communication with the core network.
  • UNC unlicensed network controller
  • UMAN unlicensed mobile access network
  • GANC generic access network controller
  • GAN generic access network
  • the present invention provides a method and apparatus that protects the core network by checking the mobile identities (International Mobile Subscriber Identity (IMSI), Temporary Mobile Subscriber Identities (TMSI) and/or Packet Temporary Mobile Subscriber Identity (P-TMSI)) used by mobile stations (MS) when they communicate with the core network.
  • IMSI International Mobile Subscriber Identity
  • TMSI Temporary Mobile Subscriber Identities
  • P-TMSI Packet Temporary Mobile Subscriber Identity
  • FIGURE 1 a representative signaling sequence depicting the use of mobile identities between an unlicensed mobile access (UMA) network (UMAN) or a generic access network (GAN) 100 and a core network 102 is shown.
  • the MS 104 provides the IMSI to the secure gateway of the unlicensed network controller (UNC-SGW) or generic access network controller (GANC-SEGW) 106 using EAP-SIM or EAP-AKA when the MS 104 establishes the IPsec secure connection 108 towards the UNC-SGW or GANC-SEGW 106.
  • the UNC-SGW or GANC-SEGW 106 authenticates 110 this IMSI in the HLR 110 using well known signaling and authentication protocols (authentication, authorization and accounting (AAA) infrastructure 114).
  • AAA authentication, authorization and accounting
  • the MS 104 also provides the IMSI to the unlicensed network controller (UNC) or generic access network controller (GANC) 116 when the MS 104 registers 118 with the UNC or GANC 116.
  • the MS 104 uses IMSI, TMSI or P-TMSI to identify itself when the MS 104 communicates 120 with the core network 102 (e.g., MSC 112).
  • TMSI and P-TMSI are not reported to the UNC or GANC 116 when registering 118.
  • the TMSI and P-TMS1 have significance only within a location area. Outside the location area, the TMSI and P-TMSI have to be combined with the Location Area Identifier (LAI) to provide for an unambiguous identity.
  • LAI Location Area Identifier
  • the TMSI or P-TMSI reallocations are performed at least at each change of a location area. Such choices are left to the network operator.
  • MM Mobility Management
  • VLR Visit Location Register
  • the UNC or GANC 116 receives a message containing a mobile identity of a MS 104 in block 202.
  • the UNC or GANC 116 determines whether the received mobile identity is correct by comparing it to a stored mobile identity that is associated with the MS 104 in block 204. If the received mobile identity is correct, as determined in decision block 206, the received message is processed (e.g., forwarded, etc.) in block 208. If, however, the received mobile identity is not correct, as determined in decision block 206, the received message is dropped in block 210.
  • the mobile identity can be an IMSI, TMSI or a P-TMSI.
  • the received message can be an uplink message or a downlink message, such as a Mobility Management (MM) message, a General Packet Radio Service (GPRS) Mobility Management (GMM) message, or a UMA or Unlicensed Radio Resources (URR) message (only used between the MS 104 and UNC 116).
  • MM Mobility Management
  • GPRS General Packet Radio Service
  • GMM General Packet Radio Service
  • UMR Unlicensed Radio Resources
  • the UNC or GANC 116 determines whether the mobile identity of the MS 104 is correct by performing a layer violation, i.e., sneaking into the upper layer messages sent by the MS 104 towards the core network 102 to see if the MS 104 is using the same IMSI as it used for registering with the UNC or GANC 116. Since the TMSI value is assigned by the MSC/VLR 112 and the P-TMSI is assigned by the SGSN, the UNC or GANC 116 can check that the MS 104 is using the value assigned by the MSC 112.
  • the present invention can be implemented as an apparatus, such as UNC or GANC 116, that includes a data storage device communicably coupled to a processor.
  • the data storage device stores associations of mobile identities to MSs 104.
  • the processor receives a message 202 containing a mobile identity of a MS 104 and drops the message 210 whenever the received mobile identity does not match a stored mobile identity associated with the MS 104.
  • the processor can be a pre-processor, filter or other processing device within the apparatus.
  • the data storage device can be a memory, disk drive, hard drive, etc.
  • FIGURE 3 a signaling sequence 300 depicting the use of one embodiment of the present invention with respect to uplink messages 302 is shown.
  • the UNC or GANC 116 checks 304 the mobile identity. If the uplink message 302 is a registration request (i.e., a new MS 104), the UNC or GANC 116 will store the received mobile identity and associate it with the MS 104, and process the received message (i.e., perform the registration). If the check 304 fails - the received mobile identity does not match the stored mobile identity associated with the MS 104 - the message 302 is dropped.
  • a registration request i.e., a new MS 104
  • the UNC or GANC 116 will store the received mobile identity and associate it with the MS 104, and process the received message (i.e., perform the registration). If the check 304 fails - the received mobile identity does not match the stored mobile identity associated with the MS 104 - the message 302 is dropped.
  • the UNC or GANC 116 processes the message 302 (e.g., forwards message 306).
  • the mobile identity may be undetectable in some of the GMM-messages GPRS Mobility Management (GMM) messages between the MS 104 and the SGSN because they can be sent ciphered on LLC-layer and the UNC or GANC 116 cannot easily sneak into these messages.
  • GMM GMM-messages GPRS Mobility Management
  • the ROUTING AREA UPDATE REQUEST message is normally sent unciphered and the UNC or GANC 116 can perform checks on this message.
  • the UNC or GANC 116 checks that this IMSI is the same as the one provided by the MS 104 during registration. If it is the same, then the message 306 is forwarded to the core network. If it is different, the message is dropped.
  • the UNC or GANC 116 may also deregister the MS 104 and black list temporarily the IP address used by the MS 104. Other actions may include notifying the operator with an alarm and logging the event.
  • the uplink message 302 contains a TMSI or a P-TMSI and the UNC or GANC 116 has not stored a TMSI or P-TMSI for this MS 104, the TMSI or P-TMSI is stored in the MS 104 context. If, however, the UNC or GANC 116 has already stored a TMSI or P-TMSI for this MS 104, the UNC or GANC 116 checks that these TMSI or P-TMSI values are the same. If they are same, the message 306 is forwarded to the core network. If they are different, the message is dropped. The UNC or GANC 116 may also deregister the MS 104 and black list temporarily the IP address used by the MS 104. Other actions may include notifying the operator with an alarm and logging the event.
  • FIGURE 4 a signaling sequence 400 depicting the use of one embodiment of the present invention with respect to downlink messages 402 is shown.
  • the UNC or GANC 116 receives a downlink message 402 containing a mobile identity
  • the UNC or GANC 116 checks 404 the mobile identity. If the downlink message 402 contains a new mobile identity (newly assigned or changed) for a MS 104, the UNC or GANC 116 will store the received mobile identity and associate it with the MS 104, and process the received message (i.e., forward the message 406 to the MS 104).
  • the received message is processed (i.e., forward the message 406 to the MS 104).
  • the mobile identity can be held and not stored until an uplink message is received that accepts, acknowledges or completes the downlink message 402.
  • a downlink message 402 is a TMSI REALLOCATION COMMAND
  • the UNC or GANC 116 stores the assigned TMSI value in the MS 104 context.
  • Downlink messages are received on a signaling connection that is associated with the MS 104 context.
  • the storing of the TMSI to the MS 104 context could also be delayed until a TMSI REALLOCATION COMPLETE message is received from the MS 104.
  • the downlink message 402 is a LOCATION UPDATING ACCEPT and a new TMSI is assigned to the MS 104
  • the UNC or GANC 116 stores the assigned TMSI value in the MS 104 context.
  • the storing of the TMSI to the MS 104 context could also be delayed until a TMSI REALLOCATION COMPLETE message is received from the MS 104.
  • the process for a P-TMSI REALLOCATION COMMAND is handled the same way.
  • FIGURE 5 a flow chart depicting a method 500 in accordance with one embodiment of the present invention with respect to uplink messages is shown.
  • a uplink message is received in block 502. If the received message does not contain a mobile identity of the MS (or is undetectable), as determined in decision block 504, the uplink message is processed in block 506 (e.g., forwarded, executed, etc.). If, however, the uplink message contains a mobile identity of the MS, as determined in decision block 504, and the mobile identity is an IMSI, as determined in decision block 508, and the uplink message is a registration request, as determined in decision block 510, the IMSI is stored and associated with the MS and the MS is registered in block 512.
  • the IMSI is stored and associated with the MS and the MS is registered in block 512.
  • the uplink message is not a registration request, as determined in decision block 510, and the received IMSI matches the stored IMSI associated with the MS, as determined in decision block 514, the message is processed normally in block 506. If, however, the received IMSI does not match the stored IMSI associated with the MS, as determined in decision block 514, the message is dropped in block 516.
  • the UNC or GANC 116 may also perform any or all of the following actions: deregister the MS in block 518; black list the IP address associated with the MS for a period of time in block 520; notify a system operator of the dropped message and deregistration of the mobile station in block 522; or log information about the dropped message and deregistration of the mobile station in block 524.
  • the mobile identity is a TMSI or P-TMSI, as determined in decision block 508, and a TMSI or P-TMSI has not already been stored for the MS, as determined in decision block 526
  • the TMSI or P-TMSI is stored and associated with the MS in block 528 and the message is processed normally in block 506. If, however, a TMSI or P-TMSI has already been stored for the MS, as determined in decision block 526, and the received TMSI or P-TMSI matches the stored TMSI or P-TMSI associated with the MS, as determined in decision block 530, the message is processed normally in block 506.
  • the message is dropped in block 516.
  • the UNC or GANC 116 may also perform any or all of the following actions: deregister the MS in block 518; black list the IP address associated with the MS for a period of time in block 520; notify a system operator of the dropped message and deregistration of the mobile station in block 522; or log information about the dropped message and deregistration of the mobile station in block 524.
  • a downlink message is received in block 602. If the downlink message does not contain a TMSI or P-TMSI for the MS (or is undetectable), as determined in decision block 604, the downlink message is processed in block 606 (e.g., forwarded, executed, etc.).
  • the downlink message contains a TMSI or P-TMSI for the MS, as determined in decision block 604, and the TMSI or P-TMSI is not new (i.e., the UNC or GANC 116 has already stored and associated it with the MS), as determined in decision block 608, the downlink message is processed normally in block 606. If, however, the TMSI or P-TMSI is new, as determined in decision block 608, the TMSI or P-TMSI is stored and associated with the MS in block 610 and the message is processed normally in block 606.
  • FIGURE 7 a flow chart depicting a method 700 in accordance with another embodiment of the present invention with respect to downlink messages is shown.
  • a downlink message is received in block 702. If the downlink message does not contain a TMSI or P-TMSI for the MS (or is undetectable), as determined in decision block 704, the downlink message is processed in block 706 (e.g., forwarded, executed, etc.). If, however, the downlink message contains a TMSI or P-TMSI for the MS, as determined in decision block 704, and the TMSI or P-TMSI is not new (i.e., the INC or GANC has already stored and associated it with the MS), as determined in decision block 708, the downlink message is processed normally in block 706.
  • the TMSI or P-TMSI is held in block 710 and the message is processed normally in block 712.
  • the TMSI or P-TMSI is held until an uplink message is received that accepts, acknowledges or completes the received downlink message containing the held TMSI or P-TMSI in block 714. Thereafter, the held TMSI or P-TMSI is stored and associated with the MS in block 716 and the uplink message is processed normally in block 718.
  • any of the above-described methods can be implemented as a computer program embodied on a computer readable medium wherein the various method steps are implemented by one or more code segments.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)
  • Storage Device Security (AREA)
  • Optical Fibers, Optical Fiber Cores, And Optical Fiber Bundles (AREA)

Claims (22)

  1. Verfahren zum Schützen eines Kernnetzwerkes (102) mit den Schritten:
    Empfangen (202) einer Nachricht (302, 402), die eine Mobilidentität einer Mobilstation (104) umfasst, an einem Netzwerksteuergerät (116) innerhalb eines unlizensierten Mobilzugangsnetzwerkes oder eines generischen Zugangsnetzwerkes (100), wobei das Verfahren gekennzeichnet ist, durch:
    Bestimmen (206) an dem Netzwerksteuergerät (116), ob die empfangene Mobilidentität mit der gespeicherten Mobilidentität übereinstimmt, die and dem Netzwerksteuergerät (116) gespeichert ist; und
    Fallenlassen (210) der Nachricht (302, 402) an dem Netzwerksteuergerät (116), immer wenn die empfangene Mobilidentität nicht mit einer gespeicherten Mobilidentität übereinstimmt, die mit der Mobilstation (104) verknüpft ist.
  2. Verfahren nach Anspruch 1, weiter mit dem Schritt eines Verarbeitens (208) der Nachricht (302, 402), immer wenn die empfangene Mobilidentität mit der gespeicherten Mobilidentität übereinstimmt, die mit der Mobilstation (104) verknüpft ist.
  3. Verfahren nach Anspruch 1, wobei die Mobilidentität eine internationale Mobilteilnehmeridentität (International Mobile Subscriber Identity), eine temporäre Mobilteilnehmeridentität (Temporary Mobile Subscriber Identity) oder eine Paket-temporäre Mobilteilnehmeridentität (Packet Temporary Mobile Subscriber Identity) ist.
  4. Verfahren nach Anspruch 1, wobei die Nachricht (302, 403) eine Uplink-Nachricht (302) oder eine Downlink-Nachricht (402) ist.
  5. Verfahren nach Anspruch 4, wobei die Uplink-Nachricht (302) von einer Mobilvermittlungsstelle (112) oder einem Allgemein-Paketfunkdienst-Unterstützungsknoten (General Packet Service Support Node) empfangen wird.
  6. Verfahren nach Anspruch 1, weiter mit dem Schritt eines Speicherns (512) der empfangenen Mobilidentität an den Netzwerksteuergerät (116) und Verarbeitens der empfangenen Nachricht (302, 402), immer wenn die empfangene Nachricht (302, 402) eine Registrierungsanfrage ist.
  7. Verfahren nach Anspruch 1, weiter mit dem Schritt eines Speicherns (610) der empfangenen Mobilidentität an dem Netzwerksteuergerät (116) und Verarbeitens (608) der empfangenen Nachricht (302, 402), immer wenn die empfangene Nachricht (302, 402) eine Downlink-Nachricht (402) ist und die empfangene Mobilidentität eine neue Mobilidentität für die Mobilstation (104) ist.
  8. Verfahren nach Anspruch 7, wobei die empfangene Mobilidentität nicht an dem Netzwerksteuergerät (116) gespeichert wird, bis eine Uplink-Nachricht empfangen (714) wird, die die Downlink-Nachricht (402) annimmt, bestätigt oder vervollständigt.
  9. Verfahren nach Anspruch 1, wobei der Schritt eines Fallenlassens (210, 516) der empfangenen Nachricht (302, 402), weiter die Schritte umfasst:
    Abmelden (518) der Mobilstation;
    Schwarz-Abhören (520) einer Internetprotokolladresse, die mit der Mobilstation (104) verknüpft ist, für einen Zeitraum;
    Benachrichtigen (522) eines Systembetreibers von der fallen gelassenen Nachricht und Abmeldung der Mobilstation; oder
    Protokollieren (524) von Information über die fallen gelassene Nachricht und Abmeldung der Mobilstation (104).
  10. Verfahren nach Anspruch 1, wobei die empfangene Nachricht eine Mobilitätsverwaltungsnachricht (Mobility Management-Nachricht), eine Allgemein-Paketfunkdienst-Mobilitätsverwaltungsnachricht (General Packet Radio Service Mobility Management-Nachricht) oder eine unlizensierte Mobilzugangsnachricht (Unlicensed Mobile Access Message) oder eine unlizensierte Funkressourcennachricht (Unlicensed Radio Ressources Message) ist.
  11. Verfahren nach Anspruch 1, wobei das Netzwerksteuergerät (116) ein Steuergerät für ein unlizensiertes Netzwerk (116) innerhalb eines unlizensierten Mobilzugangsnetzwerkes (100) oder ein Steuergerät für ein generisches Zugangsnetzwerk (116) innerhalb eines generischen Zugangsnetzwerkes (100) in Kommunikation mit dem Kernnetzwerk ist.
  12. Computerprogramm, das auf einem Computerlesbaren-Medium verkörpert ist, zum Schützen eines Kernnetzwerkes (102) mit:
    einem Codesegment zum Empfangen (202) einer Nachricht (302, 402), die eine Mobilidentität einer Mobilstation (104) umfasst, an einem Netzwerksteuergerät (116) innerhalb eines unlizensierten Mobilzugangsnetzwerkes oder eines generischen Netzwerkes (100), wobei das Programm gekennzeichnet ist, durch:
    ein Codesegment zum Bestimmen (206) an dem Netzwerksteuergerät (116), ob die empfangene Mobilidentität mit der gespeicherten Mobilidentität übereinstimmt, die an dem Netzwerksteuergerät (116) gespeichert ist; und
    ein Codesegment zum Fallenlassen (210) der Nachricht (302, 402) an dem Netzwerksteuergerät (116), immer wenn die empfangene Mobilidentität nicht mit einer gespeicherten Mobilidentität übereinstimmt, die mit der Mobilstation (104) verknüpft ist.
  13. Computerprogramm nach Anspruch 12, weiter mit einem Codesegment zum Verarbeiten (208) der Nachricht (302, 402), immer wenn die empfangene Mobilidentität mit der gespeicherten Mobilidentität übereinstimmt, die mit der Mobilstation (104) verknüpft ist.
  14. Computerprogramm nach Anspruch 12, weiter mit einem Codesegment zum Speichern (512) der empfangenen Mobilidentität an dem Netzwerksteuergerät (116) und Verarbeiten der empfangenen Nachricht (302, 402), immer wenn die empfangene Nachricht (302, 402) eine Registrierungsanfrage ist.
  15. Computerprogramm nach Anspruch 12, weiter mit einem Codesegment zum Speichern (610) der empfangenen Mobilidentität an dem Netzwerksteuergerät (116) und Verarbeiten (608) der empfangenen Nachricht (302, 402), immer wenn die empfangene Nachricht (302, 402) eine Downlink-Nachricht (402) ist und die empfangene Mobilidentität eine neue Mobilidentität für die Mobilstation (104) ist.
  16. Computerprogramm nach Anspruch 15, wobei die empfangene Mobilidentität nicht an dem Netzwerksteuergerät (116) gespeichert wird, bis eine Uplink-Nachricht empfangen (714) wird, die die Downlink-Nachricht (402) annimmt, bestätigt oder vervollständigt.
  17. Netzwerksteuergerät (116) innerhalb eines unlizensierten Mobilzugangsnetzwerkes oder eines generischen Zugangsnetzwerkes (100), um das Kernnetzwerk (102) zu schützen, mit einem Datenspeichergerät und einem Prozessor, der übermittlungsfähig mit dem Datenspeichergerät gekoppelt ist, das angeordnet ist, eine Nachricht (302, 402) zu empfangen, die eine Mobilidentität einer Mobilstation (104) umfasst, wobei das Netzwerksteuergerät (116) dadurch gekennzeichnet ist, dass:
    das Datenspeichergerät angeordnet ist, Verknüpfungen von Mobilidentitäten mit Mobilstationen zu speichern; und
    der Prozessor angeordnet ist, zu bestimmen (206), ob die empfangene Mobilidentität mit der gespeicherten Mobilidentität übereinstimmt und die Nachricht (302, 402) fallen zu lassen (210), immer wenn die empfangene Mobilidentität nicht mit einer gespeicherten Mobilidentität übereinstimmt, die mit der Mobilstation verknüpft ist.
  18. Netzwerksteuergerät (116) nach Anspruch 17, wobei das Netzwerksteuergerät (116) ein Steuergerät für ein unlizensiertes Netzwerk (116) oder ein Steuergerät für ein generisches Zugangsnetzwerk ist.
  19. Netzwerksteuergerät (116) nach Anspruch 17, wobei der Prozessor angeordnet ist, die Nachricht (302, 402) zu verarbeiten (208), immer wenn die empfangene Mobilidentität mit der gespeicherten Mobilidentität übereinstimmt, die mit der Mobilstation (104) verknüpft ist.
  20. Netzwerksteuergerät (116) nach Anspruch 17, wobei der Prozessor angeordnet ist, die empfangene Mobilidentität in den Datenspeicher zu speichern (512) und die empfangene Nachricht (302, 402) zu verarbeiten, immer wenn die empfangene Nachricht (302, 402) eine Registrierungsanfrage ist.
  21. Netzwerksteuergerät (116) nach Anspruch 17, wobei der Prozessor angeordnet ist, die empfangene Mobilidentität in den Datenspeicher zu speichern (512) und die empfangene Nachricht (302, 402) zu verarbeiten, immer wenn die empfangene Nachricht (302, 402) eine Downlink-Nachricht (402) ist und die empfangene Mobilidentität eine neue Mobilidentität für die Mobilstation ist.
  22. Netzwerksteuergerät (116) nach Anspruch 21, wobei die empfangene Mobilidentität nicht gespeichert wird (716), bis eine Uplink-Nachricht empfangen (714) wird, die die Downlink-Nachricht (402) annimmt, bestätigt oder vervollständigt.
EP05702266A 2005-01-24 2005-01-24 Verfahren, computerprogramm und vorrichtung zum schutz eines kernnetzes Not-in-force EP1842333B1 (de)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/IB2005/000103 WO2006077449A1 (en) 2005-01-24 2005-01-24 Method and apparatus for protecting a core network

Publications (2)

Publication Number Publication Date
EP1842333A1 EP1842333A1 (de) 2007-10-10
EP1842333B1 true EP1842333B1 (de) 2008-10-22

Family

ID=34960291

Family Applications (1)

Application Number Title Priority Date Filing Date
EP05702266A Not-in-force EP1842333B1 (de) 2005-01-24 2005-01-24 Verfahren, computerprogramm und vorrichtung zum schutz eines kernnetzes

Country Status (11)

Country Link
US (1) US8428553B2 (de)
EP (1) EP1842333B1 (de)
JP (1) JP4690423B2 (de)
CN (1) CN101107814B (de)
AT (1) ATE412290T1 (de)
AU (1) AU2005325486A1 (de)
BR (1) BRPI0519869A2 (de)
DE (1) DE602005010613D1 (de)
ES (1) ES2314616T3 (de)
MX (1) MX2007008121A (de)
WO (1) WO2006077449A1 (de)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7280826B2 (en) * 2005-02-01 2007-10-09 Telefonaktiebolaget Lm Ericsson (Publ) Method, system and apparatus for providing security in an unlicensed mobile access network or a generic access network
EP2381713A1 (de) * 2010-04-26 2011-10-26 Research In Motion Limited Vorrichtung und Verfahren zur Implementierung einer Sicherheitsmodulskonfiguration bei einer drahtlosen Kommunikationsvorrichtung
GB2491889A (en) * 2011-06-17 2012-12-19 Sony Corp Trial period cellular network connection with identity modules of multiple devices loaded with multiple identities from a shared pool
WO2018089442A2 (en) * 2016-11-09 2018-05-17 Intel IP Corporation Ue and devices for detach handling
CN110234105B (zh) * 2018-03-06 2022-04-01 中国移动通信有限公司研究院 检测vlr是否验证拒绝服务指令的方法及装置

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6301242B1 (en) * 1998-07-24 2001-10-09 Xircom Wireless, Inc. Communication system with fast control traffic
US5890062A (en) * 1996-05-16 1999-03-30 Trw Inc. Satellite-based cellular telecommunications system utilizing a multiple registration location register
JPH11127468A (ja) * 1997-10-20 1999-05-11 Fujitsu Ltd 通信制御装置及び無線通信システム
FI107689B (fi) * 1998-04-03 2001-09-14 Nokia Networks Oy Menetelmä merkinantoyhteyden muodostamiseksi
AU2160399A (en) * 1998-12-10 2000-06-26 Nokia Networks Oy A method for a secure detach procedure in a radio telecommunication network
US6842615B2 (en) * 2000-07-14 2005-01-11 Comsat Corporation Least cost routing for mobile satellite systems employing a GPRS network infrastructure
US7016325B2 (en) * 2001-01-18 2006-03-21 Strix Systems, Inc. Link context mobility method and system for providing such mobility, such as a system employing short range frequency hopping spread spectrum wireless protocols
JP3502048B2 (ja) * 2001-02-02 2004-03-02 パナソニック コミュニケーションズ株式会社 画情報送信システム、スキャナ装置およびユーザー端末装置、並びに画情報送信方法
JP2002271874A (ja) * 2001-03-09 2002-09-20 Sharp Corp データ通信システムおよび端末網制御装置
FI118244B (fi) * 2001-06-27 2007-08-31 Nokia Corp Otsikkokenttien kompressiotunnisteen välittäminen datapakettiyhteydellä
US20030081607A1 (en) * 2001-10-30 2003-05-01 Alan Kavanagh General packet radio service tunneling protocol (GTP) packet filter
JP4292802B2 (ja) 2003-01-08 2009-07-08 日本電気株式会社 移動通信網、無線ネットワーク制御装置、移動端末及びそれらに用いる輻輳低下方法
CN101384005A (zh) * 2003-06-13 2009-03-11 北京三星通信技术研究有限公司 通信系统中使用mbms业务的ue进行路由区域更新的方法

Also Published As

Publication number Publication date
ES2314616T3 (es) 2009-03-16
BRPI0519869A2 (pt) 2009-08-04
MX2007008121A (es) 2007-08-23
WO2006077449A1 (en) 2006-07-27
DE602005010613D1 (de) 2008-12-04
CN101107814A (zh) 2008-01-16
CN101107814B (zh) 2010-10-13
US8428553B2 (en) 2013-04-23
US20080146222A1 (en) 2008-06-19
JP2008529330A (ja) 2008-07-31
AU2005325486A1 (en) 2006-07-27
JP4690423B2 (ja) 2011-06-01
EP1842333A1 (de) 2007-10-10
ATE412290T1 (de) 2008-11-15

Similar Documents

Publication Publication Date Title
US7280826B2 (en) Method, system and apparatus for providing security in an unlicensed mobile access network or a generic access network
US12069078B2 (en) Method and system for user plane traffic characteristics and network security
CN106332067B (zh) 防止无线网络中直径信令攻击的方法、装置和系统
CN112219381B (zh) 用于基于数据分析的消息过滤的方法和装置
US8554912B1 (en) Access management for wireless communication devices failing authentication for a communication network
US20210067560A1 (en) Access point name and application identity based security enforcement in service provider networks
KR20070104633A (ko) 코어 네트워크를 보호하는 방법 및 장치
US20110228744A1 (en) Application Identification in Mobile Networks
CN108464027A (zh) 对于未认证用户通过wlan接入3gpp演进分组核心支持紧急服务
EP1842333B1 (de) Verfahren, computerprogramm und vorrichtung zum schutz eines kernnetzes
US9560524B1 (en) Wireless network application access by a wireless communication device via an untrusted access node
WO2016148685A1 (en) Method and system for defending a mobile network from a fraud
WO2022185095A1 (en) Diameter spoofing detection and post-spoofing attack prevention

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20070621

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU MC NL PL PT RO SE SI SK TR

RIN1 Information on inventor provided before grant (corrected)

Inventor name: NYLANDER, THOMAS

Inventor name: VIKBERG, JARI, TAPIO

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

DAX Request for extension of the european patent (deleted)
RTI1 Title (correction)

Free format text: METHOD, COMPUTER PROGRAM AND APPARATUS FOR PROTECTING A CORE NETWORK

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU MC NL PL PT RO SE SI SK TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REF Corresponds to:

Ref document number: 602005010613

Country of ref document: DE

Date of ref document: 20081204

Kind code of ref document: P

REG Reference to a national code

Ref country code: ES

Ref legal event code: FG2A

Ref document number: 2314616

Country of ref document: ES

Kind code of ref document: T3

NLV1 Nl: lapsed or annulled due to failure to fulfill the requirements of art. 29p and 29m of the patents act
PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081022

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081022

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20090122

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081022

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20090323

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20090222

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081022

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081022

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081022

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081022

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081022

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081022

Ref country code: BE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081022

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20090122

Ref country code: MC

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090131

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081022

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

26N No opposition filed

Effective date: 20090723

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081022

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090131

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090131

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090124

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20090123

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090124

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20090423

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081022

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081022

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 12

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 13

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 14

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: IT

Payment date: 20190123

Year of fee payment: 15

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200124

REG Reference to a national code

Ref country code: ES

Ref legal event code: FD2A

Effective date: 20210604

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200125

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20230125

Year of fee payment: 19

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20230127

Year of fee payment: 19

Ref country code: DE

Payment date: 20230127

Year of fee payment: 19

REG Reference to a national code

Ref country code: DE

Ref legal event code: R119

Ref document number: 602005010613

Country of ref document: DE

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20240124

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20240801

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20240124

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20240131